Regular Expression Denial Of Service (ReDoS)

2022-09-1610:16:05

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

redos

insecure regex

application crash

main.js

EPSS

0.001

Percentile

46.6%

JSON

steal is vulnerable to prototype pollution. The vulnerability is possible because of the use of insecure regular expression for input in main.js, causing an application crash.

References

github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L2490

github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L3344

github.com/stealjs/steal/issues/1529

EPSS

0.001

Percentile

46.6%

JSON

Related for VERACODE:37061